9. Securing Web Applications

MIT 6.858 Computer Systems Security, Fall 2014
Instructor: James Mickens

In this lecture, Professor Mickens continues looking at how to build secure web applications.

License: Creative Commons BY-NC-SA

[luckynumbersevuuun]

at 37:20, one of the most effective use of the CSP is to limit where javascript can be sourced from. this will get you pretty far down the road against most XSS and other hybrid attacks.

[alimatthew]

you are very great lecturer i wish i get in touch with doing the great job

[PMA]

43:00 DROP TABLE tablename; DELETE is used for deleting (some) records from a table.

[marveladeguitar]

In the third XSS example that didn't work @10:22, judging from the web server logs @10:43, the stripping was already done when the request hit the web server. Without testing this, I'm going to take a guess and say that it's the semicolon that tripped this example; not a browser mechanism that filtered the response and definitely not because of the X-XSS-Protection header being set to 0. That header will only tell the browser what to do with the *response*. It doesn't know about that response header yet when it sends the request.

[ClearlyCero]

Quite a lot to think about, so many more vectors than I knew about.

[armandkruger]

Input Validation, parameterized queries, static & dynamic code analysis is the future to secure code development

[aidanbrumsickle]

Use prepared/parameterized statements for SQL!

[Greatfulone]

I did not catch how putting the sensitive info in the DOM keeps JavaScript eval() from accessing it.

[dzungnguyen]

this is the great course, I know a lot of stuffs here and why it's important. Finally, I can understand and visualize how these things work

[voikalternos]

fascinating to learn how things are different 10 years ago

[lets_discuss]

Prof. Mickens, for the SQL injection attack, would using stored procedures be a way to prevent malicious content being used for injection?

[blenderpanzi]

Why is bash even looking at the contents of env vars if they are set via setenv(), let alone under any circumstance interpret it as a function? That does not make any sense to me.

[GamingBlake]

<script>alert('Great video!');</script>

[SportsIncorporated]

I went to college in the 1970's. Instructors are still using a blackboard and chalk.

[redstoneprojectrules]

Lol, "how to prevent xss access to secrets" "hand them out as a capability and store them plain in your html"...

[predatorBr]

Ways to stop SQLi


1- User prepared Statements

2- Stored Procedures
3 - WhiteLists


And a mandatory is never ever trust user input, even if it an internal system. Even worst yet sometimes.


Use all because this called security by depth.

[jongarcia]

I can't believe he is writing on a chalkboard. The only way it could be less efficient is if he was engraving stone during the discourse. This is insane. A projector would be better.

[SportsUniqueFootage]

I think this is just me but this is a bit hard to follow. Not a fan of teaching with whiteboard and chalk.

[StijnHommes]

The easiest way to secure a web app is not to use it. That way, it can't cause any security breaches.
We don't need them, so it's not that hard to avoid "web apps" and use real apps instead.

[mikecaldwell]

Wow I remember my electrical engineering classes at a new york state university to be much more complicated then these MIT computer science classes. This is kindergarden stuff compared to electrical engineering or the many math classes I took